MITRE ATT&CKsub-technique

T1474.003 Compromise Software Supply Chain

Published 2022-03-28 Modified 2025-10-24 Official page ↗
Domain
mobile
Tactics
Initial Access
Platforms
Android, iOS
Version
1.1
Created
2022-03-28

Description

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1474 Supply Chain Compromise technique

Tactic · MITRE ATT&CK (1)

  • TA0027 Initial Access tactic

Referenced by MITRE ATT&CK · mitigates (2)

  • M1001 Security Updates mitigation
  • M1004 System Partition Integrity mitigation

Referenced by MITRE ATT&CK · uses (5)

  • S0555 CHEMISTGAMES software (malware)
  • S0424 Triada software (malware)
  • S0319 Allwinner software (malware)
  • S0328 Stealth Mango software (malware)
  • S0309 Adups software (malware)

References